[llvm] r316566 - [llvm-dwarfdump] - Fix array out of bounds access crash.
George Rimar via llvm-commits
llvm-commits at lists.llvm.org
Wed Oct 25 03:23:49 PDT 2017
Author: grimar
Date: Wed Oct 25 03:23:49 2017
New Revision: 316566
URL: http://llvm.org/viewvc/llvm-project?rev=316566&view=rev
Log:
[llvm-dwarfdump] - Fix array out of bounds access crash.
This fixes possible out of bound access in
DWARFDie::getFirstChild()
which might happen when .debug_info section is corrupted,
like shown in testcase.
Differential revision: https://reviews.llvm.org/D39185
Added:
llvm/trunk/test/tools/llvm-dwarfdump/X86/verify_debug_info2.s
Modified:
llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFDie.h
llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFUnit.h
llvm/trunk/lib/DebugInfo/DWARF/DWARFDie.cpp
llvm/trunk/lib/DebugInfo/DWARF/DWARFUnit.cpp
Modified: llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFDie.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFDie.h?rev=316566&r1=316565&r2=316566&view=diff
==============================================================================
--- llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFDie.h (original)
+++ llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFDie.h Wed Oct 25 03:23:49 2017
@@ -108,11 +108,7 @@ public:
///
/// \returns a valid DWARFDie instance if this object has children or an
/// invalid DWARFDie instance if it doesn't.
- DWARFDie getFirstChild() const {
- if (isValid() && Die->hasChildren())
- return DWARFDie(U, Die + 1);
- return DWARFDie();
- }
+ DWARFDie getFirstChild() const;
/// Dump the DIE and all of its attributes to the supplied stream.
///
Modified: llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFUnit.h
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFUnit.h?rev=316566&r1=316565&r2=316566&view=diff
==============================================================================
--- llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFUnit.h (original)
+++ llvm/trunk/include/llvm/DebugInfo/DWARF/DWARFUnit.h Wed Oct 25 03:23:49 2017
@@ -372,6 +372,7 @@ public:
DWARFDie getParent(const DWARFDebugInfoEntry *Die);
DWARFDie getSibling(const DWARFDebugInfoEntry *Die);
+ DWARFDie getFirstChild(const DWARFDebugInfoEntry *Die);
/// \brief Return the DIE object for a given offset inside the
/// unit's DIE vector.
Modified: llvm/trunk/lib/DebugInfo/DWARF/DWARFDie.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/DebugInfo/DWARF/DWARFDie.cpp?rev=316566&r1=316565&r2=316566&view=diff
==============================================================================
--- llvm/trunk/lib/DebugInfo/DWARF/DWARFDie.cpp (original)
+++ llvm/trunk/lib/DebugInfo/DWARF/DWARFDie.cpp Wed Oct 25 03:23:49 2017
@@ -511,6 +511,12 @@ DWARFDie DWARFDie::getSibling() const {
return DWARFDie();
}
+DWARFDie DWARFDie::getFirstChild() const {
+ if (isValid())
+ return U->getFirstChild(Die);
+ return DWARFDie();
+}
+
iterator_range<DWARFDie::attribute_iterator> DWARFDie::attributes() const {
return make_range(attribute_iterator(*this, false),
attribute_iterator(*this, true));
Modified: llvm/trunk/lib/DebugInfo/DWARF/DWARFUnit.cpp
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/lib/DebugInfo/DWARF/DWARFUnit.cpp?rev=316566&r1=316565&r2=316566&view=diff
==============================================================================
--- llvm/trunk/lib/DebugInfo/DWARF/DWARFUnit.cpp (original)
+++ llvm/trunk/lib/DebugInfo/DWARF/DWARFUnit.cpp Wed Oct 25 03:23:49 2017
@@ -450,6 +450,17 @@ DWARFDie DWARFUnit::getSibling(const DWA
return DWARFDie();
}
+DWARFDie DWARFUnit::getFirstChild(const DWARFDebugInfoEntry *Die) {
+ if (!Die->hasChildren())
+ return DWARFDie();
+
+ // We do not want access out of bounds when parsing corrupted debug data.
+ size_t I = getDIEIndex(Die) + 1;
+ if (I >= DieArray.size())
+ return DWARFDie();
+ return DWARFDie(this, &DieArray[I]);
+}
+
const DWARFAbbreviationDeclarationSet *DWARFUnit::getAbbreviations() const {
if (!Abbrevs)
Abbrevs = Abbrev->getAbbreviationDeclarationSet(AbbrOffset);
Added: llvm/trunk/test/tools/llvm-dwarfdump/X86/verify_debug_info2.s
URL: http://llvm.org/viewvc/llvm-project/llvm/trunk/test/tools/llvm-dwarfdump/X86/verify_debug_info2.s?rev=316566&view=auto
==============================================================================
--- llvm/trunk/test/tools/llvm-dwarfdump/X86/verify_debug_info2.s (added)
+++ llvm/trunk/test/tools/llvm-dwarfdump/X86/verify_debug_info2.s Wed Oct 25 03:23:49 2017
@@ -0,0 +1,42 @@
+# RUN: llvm-mc %s -filetype obj -triple=i686-pc-linux -o %t
+# RUN: not llvm-dwarfdump -v -verify %t 2>&1 | FileCheck %s
+# CHECK: The length for this unit is too large for the .debug_info provided.
+
+## Check we do not crash when trying to parse truncated .debug_info.
+.section .debug_info,"", at progbits
+ .long 0x1c
+ .value 0x4
+ .long .Ldebug_abbrev0
+ .byte 0x4
+
+ .uleb128 0x1 # DW_TAG_compile_unit [1] *
+ .long 0 # DW_AT_producer [DW_FORM_strp] ( .debug_str[0x00000000] = "test")
+ .byte 0x4 # DW_AT_language [DW_FORM_data1] (DW_LANG_C_plus_plus)
+ .long 0 # DW_AT_name [DW_FORM_strp] ( .debug_str[0x00000000] = "test")
+ .long 0 # DW_AT_comp_dir [DW_FORM_strp] ( .debug_str[0x00000000] = "test")
+ .long 0 # DW_AT_low_pc [DW_FORM_addr] (0x0000000000000000)
+ .long 0 # DW_AT_high_pc [DW_FORM_data4] (0x00000000)
+
+.section .debug_abbrev,"", at progbits
+.Ldebug_abbrev0:
+ .uleb128 0x1
+ .uleb128 0x11 # DW_TAG_compile_unit, DW_CHILDREN_yes
+ .byte 0x1
+ .uleb128 0x25 # DW_AT_producer, DW_FORM_strp
+ .uleb128 0xe
+ .uleb128 0x13 # DW_AT_language, DW_FORM_data1
+ .uleb128 0xb
+ .uleb128 0x3 # DW_AT_name, DW_FORM_strp
+ .uleb128 0xe
+ .uleb128 0x1b # DW_AT_comp_dir, DW_FORM_strp
+ .uleb128 0xe
+ .uleb128 0x11 # DW_AT_low_pc, DW_FORM_addr
+ .uleb128 0x1
+ .uleb128 0x12 # DW_AT_high_pc, DW_FORM_data4
+ .uleb128 0x6
+ .byte 0
+ .byte 0
+ .byte 0
+
+.section .debug_str,"MS", at progbits,1
+.string "test"
More information about the llvm-commits
mailing list